Managing Risk Across the Vulnerability Ecosystem
summary
Dell builds a dependency management platform that ingests product inventories and exports SPDX 2.3 SBOMs, uses a SEA tool backend to feed automated vulnerability findings, and assigns supplier and OSS trustworthiness scores plus a trusted repository gate so risky components can fail the build. New vulnerabilities automatically open vulnerability response reports and trigger automated VEX and advisories linked to product mappings; metrics dashboards and VP‑to‑VP escalation enforce supplier SLAs. Next roadmap item is correlating source and binary SCA over ~3 years.
AI-written summary · about
chapters (7)
- 0:00Managing risk introduction
- 1:23Security strategy with inventory
- 7:30Dependency management platform
- 15:59Third-party risk management
- 26:42PERT outputs for remediation
- 32:17Faster vulnerability response
- 32:38Q&A on SBOMs and compliance
related talks
44mProtecting Customers Through Smarter OSS Management
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
33mVulnerability Management Lifecycle in DevSecOps
36mSupplier Risk Where OSS Collides With Vendor Management
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
54mSupply Chain Sec /w Dependency Track
27mEffective Vulnerability Management for a DevSecOps Pipeline
13mManaging Vulnerabilities in Open-Source Dependencies